SSL / Security Question
I recently switched to Trillian's web IM client and had a quick question about the security. I noticed I cannot choose to use SSL (https) when accessing the client and all communication with the trillian service is over http. I see the message data appears to be encrypted. I was wondering if you could speak to the security of this? What type of encryption is used to secure messages and other information in transit to/from my computer to trillian servers? Is it easy to hijack my IM session since presumably any session token or identifier associating by browser with my chat session is sent in the clear? Is there any preference to enable HTTPS?
Thanks.
Support Staff 2 Posted by Scott Werndorfer on 30 Jun, 2012 01:03 AM
Hi Drew - right now SSL is only used for your initial login and any subsequent request that requires transmission of a password. While your HTTP-based traffic can be read by a third party, session hijacking is protected by use of HMACs, the key for which is a nonce transmitted over SSL during your initial login. Replay attacks are also prevented by our protocol's native use of sequence numbers, such that anyone watching traffic over the wire replaying a particular message can only receive the same response your client already received. That being said, the next iteration of our server technology will support a pure SSL mode and we'll be making this mode the default behavior for all clients moving forward. I hope this helps!
3 Posted by drew on 30 Jun, 2012 01:11 AM
Thanks for the good explanation and answer. It sounds sufficient and I feel more secure in using the web IM client now that I know some of those facts.
4 Posted by James on 18 Dec, 2012 04:28 PM
Has this SSL mode been implemented yet?
Support Staff 5 Posted by Kevin Kurtz on 02 Jan, 2013 03:01 PM
James,
Unfortunately we have not yet updated the web version to do full ssl for all messages. However we have updated the servers to support it and plan on updating it within the next few weeks (if not sooner).
Sorry for the delay.
-Kevin
6 Posted by James on 06 Jan, 2013 06:46 PM
Ok, I'll keep an eye out for it. Thanks so much for your response, Kevin!
Support Staff 7 Posted by Kevin Kurtz on 21 Jan, 2013 09:30 PM
We have updated the Trillian for Web client to use all SSL. Look at the bottom right for version 2.0.0.622.
-Kevin
8 Posted by James on 26 Jan, 2013 07:08 PM
Awesome! Thanks for the update Kevin.